Beispiel #1
0
    def createFields(self):
        field_thunks = (
            lambda: Bit(self, "is_writable", "Section contains writable data?"),
            lambda: Bit(self, "is_alloc", "Section occupies memory?"),
            lambda: Bit(self, "is_exec", "Section contains executable instructions?"),
            lambda: NullBits(self, "reserved[]", 1),
            lambda: Bit(self, "is_merged", "Section might be merged to eliminate duplication?"),
            lambda: Bit(self, "is_strings", "Section contains nul terminated strings?"),
            lambda: Bit(self, "is_info_link", "sh_info field of this section header holds section header table index?"),
            lambda: Bit(self, "preserve_link_order", "Section requires special ordering for linker?"),
            lambda: Bit(self, "os_nonconforming", "Section rqeuires OS-specific processing?"),
            lambda: Bit(self, "is_group", "Section is a member of a section group?"),
            lambda: Bit(self, "is_tls", "Section contains TLS data?"),
            lambda: Bit(self, "is_compressed", "Section contains compressed data?"),
            lambda: NullBits(self, "reserved[]", 8),
            lambda: RawBits(self, "os_specific", 8, "OS specific flags"),
            lambda: RawBits(self, "processor_specific", 4, "Processor specific flags"),
        )

        if self.root.endian == BIG_ENDIAN:
            if self.root.is64bit:
                yield RawBits(self, "reserved[]", 32)
            for t in reversed(field_thunks):
                yield t()
        else:
            for t in field_thunks:
                yield t()
            if self.root.is64bit:
                yield RawBits(self, "reserved[]", 32)
Beispiel #2
0
    def createFields(self):
        yield Bits(self, "version", 4, "Version")
        yield Bits(self, "hdr_size", 4, "Header size divided by 5")

        # Type of service
        yield Enum(Bits(self, "precedence", 3, "Precedence"),
                   self.precedence_name)
        yield Bit(self, "low_delay", "If set, low delay, else normal delay")
        yield Bit(self, "high_throu",
                  "If set, high throughput, else normal throughput")
        yield Bit(self, "high_rel", "If set, high relibility, else normal")
        yield NullBits(self, "reserved[]", 2, "(reserved for future use)")

        yield UInt16(self, "length")
        yield UInt16(self, "id")

        yield NullBits(self, "reserved[]", 1)
        yield Bit(self, "df", "Don't fragment")
        yield Bit(self, "more_frag",
                  "There are more fragments? if not set, it's the last one")
        yield Bits(self, "frag_ofst_lo", 5)
        yield UInt8(self, "frag_ofst_hi")
        yield UInt8(self, "ttl", "Type to live")
        yield Enum(UInt8(self, "protocol"), self.PROTOCOL_NAME)
        yield textHandler(UInt16(self, "checksum"), hexadecimal)
        yield IPv4_Address(self, "src")
        yield IPv4_Address(self, "dst")

        size = (self.size - self.current_size) // 8
        if size:
            yield RawBytes(self, "options", size)
Beispiel #3
0
    def parseProtocolHeader(self):
        type_names = {p.typeid: p.name for p in PAYLOAD_CLASSES}
        type_names.update({k.typeid: k.name for k in EMPTY_REQUEST_PAYLOADS})

        yield NullBits(self, 'reserved[]', 64)
        yield enumConverter(Enum(UInt16(self, 'type'), type_names))
        yield NullBits(self, 'reserved[]', 16)
Beispiel #4
0
    def createFields(self):
        yield Unsigned(self, 'track')
        yield Int16(self, 'timecode')

        if self.parent._name == 'Block':
            yield NullBits(self, 'reserved[]', 4)
            yield Bit(self, 'invisible')
            yield self.lacing()
            yield NullBits(self, 'reserved[]', 1)
        elif self.parent._name.startswith('SimpleBlock'):
            yield Bit(self, 'keyframe')
            yield NullBits(self, 'reserved', 3)
            yield Bit(self, 'invisible')
            yield self.lacing()
            yield Bit(self, 'discardable')
        else:
            yield NullBits(self, 'reserved', 8)
            return

        size = (self._size - self.current_size) // 8
        lacing = self['lacing'].value
        if lacing:
            yield textHandler(GenericInteger(self, 'n_frames', False, 8),
                              lambda chunk: str(chunk.value + 1))
            yield Lace(self, lacing - 1, size - 1)
        else:
            yield RawBytes(self, 'frame', size)
Beispiel #5
0
    def createFields(self):
        yield UInt8(self, "configurationVersion")
        yield UInt8(self, "AVCProfileIndication")
        yield UInt8(self, "profile_compatibility")
        yield UInt8(self, "AVCLevelIndication")
        yield NullBits(self, "reserved[]", 6)
        yield Bits(self, "lengthSizeMinusOne", 2)
        yield NullBits(self, "reserved[]", 3)

        yield Bits(self, "numOfSequenceParameterSets", 5)
        for i in range(self["numOfSequenceParameterSets"].value):
            yield PascalString16(self, "sequenceParameterSetNALUnit[]")

        yield UInt8(self, "numOfPictureParameterSets")
        for i in range(self["numOfPictureParameterSets"].value):
            yield PascalString16(self, "pictureParameterSetNALUnit[]")

        if self['AVCProfileIndication'].value in (100, 110, 122, 144) and not self.eof:
            yield NullBits(self, "reserved[]", 6)
            yield Bits(self, "chroma_format", 2)
            yield NullBits(self, "reserved[]", 5)
            yield Bits(self, "bit_depth_luma_minus8", 3)
            yield NullBits(self, "reserved[]", 5)
            yield Bits(self, "bit_depth_chroma_minus8", 3)

            yield UInt8(self, "numOfSequenceParameterSetExt")
            for i in range(self["numOfSequenceParameterSetExt"].value):
                yield PascalString16(self, "sequenceParameterSetExtNALUnit[]")
Beispiel #6
0
def parseAviHeader(self):
    yield UInt32(self, "microsec_per_frame", "Microsecond per frame")
    yield UInt32(self, "max_byte_per_sec", "Maximum byte per second")
    yield NullBytes(self, "reserved", 4)

    # Flags
    yield NullBits(self, "reserved[]", 4)
    yield Bit(self, "has_index")
    yield Bit(self, "must_use_index")
    yield NullBits(self, "reserved[]", 2)
    yield Bit(self, "is_interleaved")
    yield NullBits(self, "reserved[]", 2)
    yield Bit(self, "trust_cktype")
    yield NullBits(self, "reserved[]", 4)
    yield Bit(self, "was_capture_file")
    yield Bit(self, "is_copyrighted")
    yield NullBits(self, "reserved[]", 14)

    yield UInt32(self, "total_frame", "Total number of frames in the video")
    yield UInt32(self, "init_frame",
                 "Initial frame (used in interleaved video)")
    yield UInt32(self, "nb_stream", "Number of streams")
    yield UInt32(self, "sug_buf_size", "Suggested buffer size")
    yield UInt32(self, "width", "Width in pixel")
    yield UInt32(self, "height", "Height in pixel")
    yield UInt32(self, "scale")
    yield UInt32(self, "rate")
    yield UInt32(self, "start")
    yield UInt32(self, "length")
Beispiel #7
0
 def parseFrameAddress(self):
     yield textHandler(Bytes(self, 'target', 8), formatTargetField)  # MAC or Zeroes
     yield NullBits(self, 'reserved[]', 48)
     yield NullBits(self, 'reserved[]', 6)
     yield Bit(self, 'ack_required')
     yield Bit(self, 'res_required')
     yield UInt8(self, 'sequence')
Beispiel #8
0
 def createFields(self):
     if self.root.endian == BIG_ENDIAN:
         yield NullBits(self, "padding[]", 29)
         for fld, desc in self.FLAGS:
             yield Bit(self, fld, "Segment is " + desc)
     else:
         for fld, desc in reversed(self.FLAGS):
             yield Bit(self, fld, "Segment is " + desc)
         yield NullBits(self, "padding[]", 29)
Beispiel #9
0
    def createFields(self):
        # Gzip header
        yield Bytes(self, "signature", 2, r"GZip file signature (\x1F\x8B)")
        yield Enum(UInt8(self, "compression", "Compression method"),
                   self.COMPRESSION_NAME)

        # Flags
        yield Bit(self, "is_text", "File content is probably ASCII text")
        yield Bit(self, "has_crc16", "Header CRC16")
        yield Bit(self, "has_extra", "Extra informations (variable size)")
        yield Bit(self, "has_filename", "Contains filename?")
        yield Bit(self, "has_comment", "Contains comment?")
        yield NullBits(self, "reserved[]", 3)
        yield TimestampUnix32(self, "mtime", "Modification time")

        # Extra flags
        yield NullBits(self, "reserved[]", 1)
        yield Bit(self, "slowest",
                  "Compressor used maximum compression (slowest)")
        yield Bit(self, "fastest", "Compressor used the fastest compression")
        yield NullBits(self, "reserved[]", 5)
        yield Enum(UInt8(self, "os", "Operating system"), self.os_name)

        # Optional fields
        if self["has_extra"].value:
            yield UInt16(self, "extra_length", "Extra length")
            yield RawBytes(self, "extra", self["extra_length"].value, "Extra")
        if self["has_filename"].value:
            yield CString(self, "filename", "Filename", charset="ISO-8859-1")
        if self["has_comment"].value:
            yield CString(self, "comment", "Comment")
        if self["has_crc16"].value:
            yield textHandler(UInt16(self, "hdr_crc16", "CRC16 of the header"),
                              hexadecimal)

        if self._size is None:  # TODO: is it possible to handle piped input?
            raise NotImplementedError()

        # Read file
        size = (self._size - self.current_size) // 8 - 8  # -8: crc32+size
        if 0 < size:
            if self["has_filename"].value:
                filename = self["filename"].value
            else:
                for tag, filename in self.stream.tags:
                    if tag == "filename" and filename.endswith(".gz"):
                        filename = filename[:-3]
                        break
                else:
                    filename = None
            yield Deflate(SubFile(self, "file", size, filename=filename))

        # Footer
        yield textHandler(
            UInt32(self, "crc32", "Uncompressed data content CRC32"),
            hexadecimal)
        yield filesizeHandler(UInt32(self, "size", "Uncompressed size"))
Beispiel #10
0
 def createFields(self):
     yield UInt8(self, "version")
     yield NullBits(self, "flags", 24)
     yield NullBits(self, "reserved[]", 24)
     yield UInt8(self, "field_size", "Size of each entry in this table, in bits")
     yield UInt32(self, "count", description="Number of samples")
     bitsize = self['field_size'].value
     for i in xrange(self['count'].value):
         yield Bits(self, "sample_size[]", bitsize)
     if self.current_size % 8 != 0:
         yield NullBits(self, "padding[]", 8 - (self.current_size % 8))
Beispiel #11
0
 def createFields(self):
     yield Bits(self, "fscod", 2)
     yield Bits(self, "bsid", 5)
     yield Bits(self, "bsmod", 5)
     yield Bits(self, "acmod", 3)
     yield Bits(self, "lfeon", 1)
     yield NullBits(self, "reserved", 3)
     yield Bits(self, "num_dep_sub", 4)
     if self["num_dep_sub"].value:
         yield Bits(self, "chan_loc", 9)
     else:
         yield NullBits(self, "reserved2", 1)
Beispiel #12
0
    def createFields(self):
        yield String(self,
                     "signature",
                     3,
                     "FLV format signature",
                     charset="ASCII")
        yield UInt8(self, "version")

        yield NullBits(self, "reserved[]", 5)
        yield Bit(self, "type_flags_audio")
        yield NullBits(self, "reserved[]", 1)
        yield Bit(self, "type_flags_video")

        yield UInt32(self, "data_offset")
Beispiel #13
0
 def createFields(self):
     yield UInt8(self, "version")
     yield NullBits(self, "flags", 24)
     yield UInt32(self, "reference_ID")
     yield UInt32(self, "timescale")
     if self["version"].value == 0:
         yield UInt32(self, "earliest_presentation_time")
         yield UInt32(self, "first_offset")
     else:
         yield UInt64(self, "earliest_presentation_time")
         yield UInt64(self, "first_offset")
     yield NullBits(self, "reserved", 16)
     yield UInt16(self, "reference_count")
     for i in range(self["reference_count"].value):
         yield SegmentIndexBoxReference(self, "reference[]")
Beispiel #14
0
 def createFields(self):
     yield UInt8(self, "version")
     yield NullBits(self, "flags", 24)
     yield NullBits(self, "reserved", 8)
     if self["version"].value == 0:
         yield NullBits(self, "reserved2", 8)
     else:
         yield Bits(self, "default_crypt_byte_block", 4)
         yield Bits(self, "default_skip_byte_block", 4)
     yield UInt8(self, "default_isProtected")
     yield UInt8(self, "default_Per_sample_IV_Size")
     yield RawBytes(self, "default_KID", 16)
     if self["default_isProtected"].value == 1 and self["default_Per_sample_IV_Size"].value == 0:
         yield UInt8(self, "default_constant_IV_size")
         yield RawBytes(self, "default_constant_IV", self["default_constant_IV_size"].value)
Beispiel #15
0
    def createFields(self):
        yield IFDTag(self, "tag", "Tag")
        yield Enum(UInt16(self, "type", "Type"), self.TYPE_NAME)
        self.value_cls = self.ENTRY_FORMAT.get(self['type'].value, Bytes)
        if issubclass(self.value_cls, Bytes):
            self.value_size = 8
        else:
            self.value_size = self.value_cls.static_size
        yield UInt32(self, "count", "Count")

        if not issubclass(self.value_cls, Bytes) \
                and self["count"].value > MAX_COUNT:
            raise ParserError("EXIF: Invalid count value (%s)" %
                              self["count"].value)

        count = self['count'].value
        totalsize = self.value_size * count
        if count == 0:
            yield NullBytes(self, "padding", 4)
        elif totalsize <= 32:
            name = "value"
            if issubclass(self.value_cls, Bytes):
                yield self.value_cls(self, name, count)
            else:
                if count > 1:
                    name += "[]"
                for i in range(count):
                    yield self.value_cls(self, name)
            if totalsize < 32:
                yield NullBits(self, "padding", 32 - totalsize)
        else:
            yield UInt32(self, "offset", "Value offset")
Beispiel #16
0
    def createFields(self):
        # Signature + version
        yield String(self, "header", 3, "Header (ID3)", charset="ASCII")
        yield UInt8(self, "ver_major", "Version (major)")
        yield UInt8(self, "ver_minor", "Version (minor)")

        # Check format
        if self["header"].value != "ID3":
            raise MatchError("Signature error, should be \"ID3\".")
        if self["ver_major"].value not in self.VALID_MAJOR_VERSIONS \
                or self["ver_minor"].value != 0:
            raise MatchError(
                "Unknown ID3 metadata version (2.%u.%u)" %
                (self["ver_major"].value, self["ver_minor"].value))

        # Flags
        yield Bit(self, "unsync", "Unsynchronisation is used?")
        yield Bit(self, "ext", "Extended header is used?")
        yield Bit(self, "exp", "Experimental indicator")
        yield NullBits(self, "padding[]", 5)

        # Size
        yield ID3_Size(self, "size")

        # All tags
        while self.current_size < self._size:
            field = ID3_Chunk(self, "field[]")
            yield field
            if field["size"].value == 0:
                break

        # Search first byte of the MPEG file
        padding = self.seekBit(self._size)
        if padding:
            yield padding
Beispiel #17
0
 def createFields(self):
     yield UInt8(self, "version")
     yield NullBits(self, "flags", 24)
     yield UInt32(self, "count", description="Total entries in sample time table")
     for i in xrange(self['count'].value):
         yield UInt32(self, "sample_count[]", "Number of consecutive samples with this delta")
         yield UInt32(self, "sample_delta[]", "Decode time delta since last sample, in time-units")
Beispiel #18
0
 def createFields(self):
     yield UInt8(self, "version", "Version (0 or 1)")
     yield NullBits(self, "flags", 24)
     if self['version'].value == 0:
         # 32-bit version
         yield TimestampMac32(self, "creation_date", "Creation time of this presentation")
         yield TimestampMac32(self, "lastmod_date", "Last modification time of this presentation")
         yield UInt32(self, "time_scale", "Number of time-units per second")
         yield UInt32(self, "duration", "Length of presentation, in time-units")
     elif self['version'].value == 1:
         # 64-bit version
         yield TimestampMac64(self, "creation_date", "Creation time of this presentation")
         yield TimestampMac64(self, "lastmod_date", "Last modification time of this presentation")
         yield UInt32(self, "time_scale", "Number of time-units per second")
         yield UInt64(self, "duration", "Length of presentation, in time-units")
     yield QTFloat32(self, "play_speed", "Preferred playback speed (1.0 = normal)")
     yield QTFloat16(self, "volume", "Preferred playback volume (1.0 = full)")
     yield NullBytes(self, "reserved[]", 10)
     yield QTFloat32(self, "geom_a", "Width scale")
     yield QTFloat32(self, "geom_b", "Width rotate")
     yield QTFloat2_30(self, "geom_u", "Width angle")
     yield QTFloat32(self, "geom_c", "Height rotate")
     yield QTFloat32(self, "geom_d", "Height scale")
     yield QTFloat2_30(self, "geom_v", "Height angle")
     yield QTFloat32(self, "geom_x", "Position X")
     yield QTFloat32(self, "geom_y", "Position Y")
     yield QTFloat2_30(self, "geom_w", "Divider scale")
     yield UInt32(self, "preview_start")
     yield UInt32(self, "preview_length")
     yield UInt32(self, "still_poster")
     yield UInt32(self, "sel_start")
     yield UInt32(self, "sel_length")
     yield UInt32(self, "current_time")
     yield UInt32(self, "next_track_ID", "Value to use as the track ID for the next track added")
Beispiel #19
0
 def createFields(self):
     yield UInt8(self, "version", "Version")
     yield NullBits(self, "flags", 23)
     yield Bit(self, "is_same_file", "Is the reference to this file?")
     if not self['is_same_file'].value:
         yield CString(self, "name")
         yield CString(self, "location")
Beispiel #20
0
    def createFields(self):
        yield textHandler(
            UInt32(self, "magic", "File information magic (0xFEEF04BD)"),
            hexadecimal)
        if self["magic"].value != 0xFEEF04BD:
            raise ParserError("EXE resource: invalid file info magic")
        yield Version(self, "struct_ver", "Structure version (1.0)")
        yield Version(self, "file_ver_ms", "File version MS")
        yield Version(self, "file_ver_ls", "File version LS")
        yield Version(self, "product_ver_ms", "Product version MS")
        yield Version(self, "product_ver_ls", "Product version LS")
        yield textHandler(UInt32(self, "file_flags_mask"), hexadecimal)

        yield Bit(self, "debug")
        yield Bit(self, "prerelease")
        yield Bit(self, "patched")
        yield Bit(self, "private_build")
        yield Bit(self, "info_inferred")
        yield Bit(self, "special_build")
        yield NullBits(self, "reserved", 26)

        yield Enum(textHandler(UInt16(self, "file_os_major"), hexadecimal),
                   MAJOR_OS_NAME)
        yield Enum(textHandler(UInt16(self, "file_os_minor"), hexadecimal),
                   MINOR_OS_NAME)
        yield Enum(textHandler(UInt32(self, "file_type"), hexadecimal),
                   FILETYPE_NAME)
        field = textHandler(UInt32(self, "file_subfile"), hexadecimal)
        if field.value == FILETYPE_DRIVER:
            field = Enum(field, DRIVER_SUBTYPE_NAME)
        elif field.value == FILETYPE_FONT:
            field = Enum(field, FONT_SUBTYPE_NAME)
        yield field
        yield TimestampUnix32(self, "date_ms")
        yield TimestampUnix32(self, "date_ls")
Beispiel #21
0
    def createFields(self):
        yield Enum(UInt16(self, "src"), self.port_name)
        yield Enum(UInt16(self, "dst"), self.port_name)
        yield UInt32(self, "seq_num")
        yield UInt32(self, "ack_num")

        yield Bits(self, "hdrlen", 6, "Header lenght")
        yield NullBits(self, "reserved", 2, "Reserved")

        yield Bit(self, "cgst", "Congestion Window Reduced")
        yield Bit(self, "ecn-echo", "ECN-echo")
        yield Bit(self, "urg", "Urgent")
        yield Bit(self, "ack", "Acknowledge")
        yield Bit(self, "psh", "Push mmode")
        yield Bit(self, "rst", "Reset connection")
        yield Bit(self, "syn", "Synchronize")
        yield Bit(self, "fin", "Stop the connection")

        yield UInt16(self, "winsize", "Windows size")
        yield textHandler(UInt16(self, "checksum"), hexadecimal)
        yield UInt16(self, "urgent")

        size = self["hdrlen"].value * 8 - self.current_size
        while 0 < size:
            option = TCP_Option(self, "option[]")
            yield option
            size -= option.size
Beispiel #22
0
def createNullField(parent, nbits, name="padding[]", description=None):
    if nbits <= 0:
        raise FieldError("Unable to create null padding of %s bits" % nbits)
    if (nbits % 8) == 0:
        return NullBytes(parent, name, nbits // 8, description)
    else:
        return NullBits(parent, name, nbits, description)
Beispiel #23
0
    def createFields(self):
        yield IFDTag(self, "tag", "Tag")
        yield Enum(UInt16(self, "type", "Type"), self.TYPE_NAME)
        self.value_cls = self.ENTRY_FORMAT.get(self['type'].value, Bytes)
        if issubclass(self.value_cls, Bytes):
            self.value_size = 8
        else:
            self.value_size = self.value_cls.static_size
        yield UInt32(self, "count", "Count")

        count = self['count'].value
        totalsize = self.value_size * count
        if count == 0:
            yield NullBytes(self, "padding", 4)
        elif totalsize <= 32:
            name = "value"
            if issubclass(self.value_cls, Bytes):
                yield self.value_cls(self, name, count)
            elif count == 1:
                yield self.value_cls(self, name)
            else:
                yield ValueArray(self, name, self.value_cls, count)
            if totalsize < 32:
                yield NullBits(self, "padding", 32 - totalsize)
        else:
            yield UInt32(self, "offset", "Value offset")
Beispiel #24
0
 def createFields(self):
     yield String(self,
                  "magic",
                  len(self.MAGIC),
                  'Magic string (%r)' % self.MAGIC,
                  charset="ASCII")
     yield UInt8(self, "major_version")
     yield UInt8(self, "minor_version")
     yield Enum(UInt8(self, "crypto"), self.CRYPTO_NAMES)
     yield Enum(UInt8(self, "hash"), self.HASH_NAMES)
     yield KeyringString(self, "keyring_name")
     yield TimestampUnix64(self, "mtime")
     yield TimestampUnix64(self, "ctime")
     yield Bit(self, "lock_on_idle")
     yield NullBits(self, "reserved[]", 31, "Reserved for future flags")
     yield UInt32(self, "lock_timeout")
     yield UInt32(self, "hash_iterations")
     yield RawBytes(self, "salt", 8)
     yield NullBytes(self, "reserved[]", 16)
     yield Items(self, "items")
     yield UInt32(self, "encrypted_size")
     yield Deflate(
         SubFile(self,
                 "encrypted",
                 self["encrypted_size"].value,
                 "AES128 CBC",
                 parser_class=EncryptedData))
Beispiel #25
0
 def createFields(self):
     yield Bit(self, "sync[]")  # =True
     yield Bits(self, "ext_length", 7)
     yield NullBits(self, "reserved[]", 8)
     size = self["ext_length"].value
     if size:
         yield RawBytes(self, "ext_bytes", size)
Beispiel #26
0
    def createFields(self):
        yield UInt16(self, "left", "Left")
        yield UInt16(self, "top", "Top")
        yield UInt16(self, "width", "Width")
        yield UInt16(self, "height", "Height")

        yield Bits(self, "size_local_map", 3,
                   "log2(size of local map) minus one")
        yield NullBits(self, "reserved", 2)
        yield Bit(self, "sort_flag",
                  "Is the local map sorted by decreasing importance?")
        yield Bit(self, "interlaced", "Interlaced?")
        yield Bit(self, "has_local_map", "Use local color map?")

        if self["has_local_map"].value:
            nb_color = 1 << (1 + self["size_local_map"].value)
            yield PaletteRGB(self, "local_map", nb_color, "Local color map")

        yield UInt8(self, "lzw_min_code_size", "LZW Minimum Code Size")
        group = None
        while True:
            size = UInt8(self, "block_size")
            if size.value == 0:
                break
            block = CustomFragment(self, "image_block[]", None, GifImageBlock,
                                   "GIF Image Block", group)
            group = block.group
            yield block
        yield NullBytes(self, "terminator", 1, "Terminator (0)")
Beispiel #27
0
    def createFields(self):
        yield Bytes(self, "header", 4, r"PE header signature (PE\0\0)")
        if self["header"].value != b"PE\0\0":
            raise ParserError("Invalid PE header signature")
        yield Enum(UInt16(self, "cpu", "CPU type"), self.cpu_name)
        yield UInt16(self, "nb_section", "Number of sections")
        yield TimestampUnix32(self, "creation_date", "Creation date")
        yield UInt32(self, "ptr_to_sym", "Pointer to symbol table")
        yield UInt32(self, "nb_symbols", "Number of symbols")
        yield UInt16(self, "opt_hdr_size", "Optional header size")

        yield Bit(self, "reloc_stripped",
                  "If true, don't contain base relocations.")
        yield Bit(self, "exec_image", "Executable image?")
        yield Bit(self, "line_nb_stripped", "COFF line numbers stripped?")
        yield Bit(self, "local_sym_stripped",
                  "COFF symbol table entries stripped?")
        yield Bit(self, "aggr_ws", "Aggressively trim working set")
        yield Bit(self, "large_addr",
                  "Application can handle addresses greater than 2 GB")
        yield NullBits(self, "reserved", 1)
        yield Bit(self, "reverse_lo",
                  "Little endian: LSB precedes MSB in memory")
        yield Bit(self, "32bit", "Machine based on 32-bit-word architecture")
        yield Bit(self, "is_stripped", "Debugging information removed?")
        yield Bit(
            self, "swap",
            "If image is on removable media, copy and run from swap file")
        yield PaddingBits(self, "reserved2", 1)
        yield Bit(self, "is_system", "It's a system file")
        yield Bit(self, "is_dll", "It's a dynamic-link library (DLL)")
        yield Bit(self, "up", "File should be run only on a UP machine")
        yield Bit(self, "reverse_hi", "Big endian: MSB precedes LSB in memory")
Beispiel #28
0
 def createFields(self):
     yield UInt8(self, "version")
     yield NullBits(self, "flags", 24)
     yield UInt32(self, "count", description="Total entries in sample time table")
     for i in xrange(self['count'].value):
         yield UInt32(self, "sample_count[]", "Number of consecutive samples with this offset")
         yield UInt32(self, "sample_offset[]",
                      "Difference between decode time and composition time of this sample, in time-units")
Beispiel #29
0
 def createFields(self):
     yield UInt8(self, "version")
     yield NullBits(self, "flags", 24)
     yield UInt32(self, "count", description="Number of samples")
     for i in xrange(self['count'].value):
         yield UInt32(self, "first_chunk[]")
         yield UInt32(self, "samples_per_chunk[]")
         yield UInt32(self, "sample_description_index[]")
Beispiel #30
0
 def createFields(self):
     yield UInt8(self, "version")
     yield NullBits(self, "flags", 24)
     yield UInt32(self, "uniform_size", description="Uniform size of each sample (0 if non-uniform)")
     yield UInt32(self, "count", description="Number of samples")
     if self['uniform_size'].value == 0:
         for i in xrange(self['count'].value):
             yield UInt32(self, "sample_size[]")